Caps and liquidity

The safety of a CDP backed by a thinly traded asset does not come from the loan-to-value ratio the borrower sees. It comes from whether the collateral can actually be sold when it has to be. Fyber therefore sets its debt ceiling from a measurement of exit depth, taken on-chain, and treats the visible collateral ratio as a product parameter rather than a risk one (principle P8).

Concretely: Tier 1 borrowers get up to 58% loan-to-value, which is competitive; and the branch as a whole never lends more than four times the depth its own liquidity oracle measured.

d2: depth at 2 % slippage

d2(token) is the notional amount of token, in USD, that can be sold against USDG across the reference Uniswap pools before the average execution price moves more than 2% from the mid. Only the sell side is measured, because that is the side a liquidation uses.

Two percent rather than one: at one percent, depth on a concentrated automated market maker is tiny and noisy; at two, the measurement is stable and lands close to the liquidation bonus, which is the number it has to cover.

The measurement is on-chain and cheap (Rule R-5.4.2):

• Uniswap v2 pairs: a closed-form calculation over the reserves.
• Uniswap v3 pools: slot0 plus iteration over initialised ticks via tickBitmap across roughly ±198 ticks around the active tick.
• Uniswap v4 pools: the same, read through StateView.

The result is converted to USD at the oracle's last regular close, never at the DEX spot price. Using the spot price would make the cap a function of the same pool the cap is trying to measure.

Pool addresses are immutable, chosen seven days before deployment on measured depth, and never changed. A cost of roughly 150 000 to 300 000 gas per sample for three pools is expected.

Sampling and the ratchet

function poke() external;   // permissionless; fills the current hourly slot if it is empty

poke() writes d2_now into a circular buffer of 168 hourly slots — seven days, packed. A slot is never rewritten within its hour. Every open and borrow calls poke() if the current slot is empty, so the borrower pays for the sample and the buffer fills without any keeper.

The effective value applies a 25th percentile and a one-way ratchet:

The 25th percentile rather than the mean or the peak is taken from the Ethena collateral framework, and for the same reason: automated market maker liquidity is extremely asymmetric over time, and a liquidation statistically arrives during a trough.

There is no d2_floor and no d2_ceil set by anyone: the floor is zero, and the ceiling is implied by the absolute tier through the outer min.

Failure modes are all restrictive and none of them touch existing positions: a pool migrating to an unknown version, a redeployed StateView, liquidity moving to an unlisted pool all drive d2 toward zero, which closes minting and leaves positions untouched. The correction is a new version of the protocol, not a setter.

The debt ceiling

Four terms, each read on-chain, combined by a minimum (Rule R-5.4.1):

with MC_onchain = token.totalSupply() × quote.price / 1e18.

The ρ term applies to the sum of the absolute tiers of activated branches, not to live debt — a term on live debt would be circular. The max(ρ, 1/n) form exists so that with only two branches active, each can still reach its own tier (Rule R-5.4.1, decision D46).

Per-address cap

This is a formula of time and state; there is nothing to raise (Rule R-5.4.3). It is trivially circumvented by using several addresses, and that is understood: its purpose is to make concentration visible on-chain during the first ninety days, not to prevent it.

Dated absolute tiers

C_abs(t) replaces the raise-the-ceiling-by-governance pattern. Each branch carries an immutable table of four tiers, dated from its own activation, with two on-chain guards (Rule R-5.4.4):

C_abs(t) is the current tier when its conditions hold; otherwise it is the last tier whose conditions were met, permanently. badDebtCumul never decreases, so a single episode of bad debt locks the branch at whatever tier it had reached — irreversibly, even if the bad debt is later covered or repaid in full. The TCR condition is re-evaluated at every mint and does not lock anything.

Events: CapTierReached, CapTierLocked.

A tier that turns out too cautious is corrected only in a future version. A tier that turns out too generous is caught by κ × d2 and σ × MC in the same minimum.

The global ceiling

That is 2 M USD from day 14 to day 90 with SPY and QQQ active, at most 6 M at day 180 with two branches, and up to 10.5 M if all twenty branches ever reach their final tier. It is never set and never raised — it is the sum of the tiers (Rule R-5.4.7).

The number is small by design. The whole on-chain market capitalisation of Robinhood Stock Tokens was roughly 42 M USD at the time the parameters were fixed. Designing for 50 M of debt on day one is the fastest route to being the protocol whose collateral cannot be sold.

When a cap falls below existing debt

A capacity queue exists only in the front end: users can ask to be notified when debtCeiling() − getEntireDebt() rises above the amount they want. There is no on-chain queue and no reservation (Rule R-5.4.6).

Worked example

A branch at day 120 from activation, third tier, with d2_eff = 1 000 000 and an on-chain market capitalisation of 40 M USD, with two branches active and both at 2.0 M:

κ × d2_eff                   = 4.0 × 1 000 000  = 4 000 000
σ × MC_onchain               = 15% × 40 000 000 = 6 000 000
C_abs(t)                     =                    2 000 000
max(40%, 1/2) × Σ C_abs      = 50% × 4 000 000  = 2 000 000
D_max                        = min(...)         = 2 000 000
addressCap                   = min(π × d2_eff = 1 000 000, 10% × 2 000 000) = 200 000
positionMax                  = π × d2_eff       = 1 000 000

The binding term here is the absolute tier. A front end shows which term binds, together with the dates and conditions of the next tier, so a borrower can see not just the remaining capacity but why it is what it is (Rule R-15.1.5).

Last reviewed: 2026-09-07 · Spec v0.4